# ScanMalware.com URL Scanner

Connect an agent to ScanMalware.com to submit URLs, inspect scan results, search findings, and retrieve TLS details. Useful when investigating a suspicious link.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI
- Author: scanmalware
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/scanmalware/mcp-server
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/scanmalwarecom-url-scanner

## What it does

This MCP server connects an agent to the public ScanMalware.com API. It can submit a URL for scanning, retrieve status and risk indicators, search scan records, and fetch TLS or certificate details. For a phishing investigation, an agent can start a scan, wait for completion, then summarize the findings.

Choose scan visibility before submission. Public scans appear in ScanMalware’s public feed; private scans require an authenticated ScanMalware account. Private access needs `SCANMALWARE_BEARER_TOKEN`. `MCP_AUTH_TOKEN` protects access to the MCP server and does not authenticate with ScanMalware. That distinction matters for confidential URLs. OCR searches need at least three characters after trimming.

## Requirements
- Remote server: `https://mcp.scanmalware.com/mcp`

## Install

### Claude Code (native platform)

**Platform CLI: remote server**
```bash
claude mcp add --transport http scanmalware-mcp https://mcp.scanmalware.com/mcp
```

### Codex

**Platform CLI: remote server**
```bash
codex mcp add scanmalwarecom-url-scanner --url https://mcp.scanmalware.com/mcp
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "scanmalwarecom-url-scanner": {
            "url": "https://mcp.scanmalware.com/mcp"
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "scanmalwarecom-url-scanner": {
            "type": "http",
            "url": "https://mcp.scanmalware.com/mcp"
        }
    }
}
```

### Gemini CLI

**Platform CLI: remote server**
```bash
gemini mcp add -t http scanmalwarecom-url-scanner https://mcp.scanmalware.com/mcp
```

## When to use it
- submit a URL and retrieve its scan risk score
- search scan records for a brand or phrase
- inspect TLS details and certificate data
- collect indicators from a suspicious link scan

## Example prompts
- Scan this URL as `unlisted`, wait for completion, then report its status, risk score, and main indicators.
- Search scans for “acme login” and list their IDs, URLs, and any high-risk results.
- Retrieve TLS and certificate details for scan `1234...abcd`, then summarize the issuer and validity dates.

## Similar
- [data-encryption](https://affpapa.org/en/nevibecode/skills/data-encryption.md) — skill · 611 installs
- [virustotal](https://affpapa.org/en/nevibecode/mcp/w0h1v-virustotal.md) — MCP server · ★ 152
- [analyzing-malicious-url-with-urlscan](https://affpapa.org/en/nevibecode/skills/analyzing-malicious-url-with-urlscan.md) — skill · 411 installs
- [finding-dev-server-url](https://affpapa.org/en/nevibecode/skills/finding-dev-server-url.md) — skill · 425 installs
- [Web Content & URL Tools](https://affpapa.org/en/nevibecode/mcp/web-content-url-tools.md) — MCP server
- [mtls-configuration](https://affpapa.org/en/nevibecode/skills/mtls-configuration.md) — skill · 10300 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md